Skills
Meta's Muse zipped its own 6.8 GB sandbox, including SSH key files and 68 skill directories, when a user asked it to
A researcher asked Meta's Muse agent to archive the files it could see and send them to Google Drive. It exported the whole runtime: internal docs, 113 subagent traces, about 68 skill directories, configs hinting at unreleased connectors, and SSH key files. Meta's bounty program marked the report 'Not Applicable.' Ars Technica separately reported a Patrick Wardle 0-day in which local apps could rewrite Muse's settings, which Meta hotfixed. The lesson for anyone shipping agents: an agent with an export connector can move its own sandbox, so keep secrets and internal docs out of any filesystem the agent can read.
Source
↳ Follow the thread